GitHub Advisoryadvisory · npm

GHSA-6x33-pw7p-hmpq Denial of Service in http-proxy

HIGH Published 2020-09-04 Modified 2024-01-29 Official page ↗
Ecosystem
npm
Packages
http-proxy
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-184, CWE-693
Reviewed
2020-08-31

Affected packages

• npm http-proxy: < 1.18.1 → fixed in 1.18.1

Description

Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function. For a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception: ```curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"``` Recommendation Upgrade to version 1.18.1 or later

Related

Weakness · CWE (2)

  • CWE-184 Incomplete List of Disallowed Inputs weakness
  • CWE-693 Protection Mechanism Failure weakness

References